diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml
index b2e4865..728128a 100644
--- a/.github/workflows/gitleaks.yml
+++ b/.github/workflows/gitleaks.yml
@@ -17,7 +17,7 @@ jobs:
   gitleaks:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with: { fetch-depth: 0 }
       # The gitleaks-action wrapper needs a license for organization repos.  This
       # runs the open-source CLI directly and scans the same commit range the
diff --git a/.github/workflows/ios-ship.yml b/.github/workflows/ios-ship.yml
index 5584eb8..a9b50f0 100644
--- a/.github/workflows/ios-ship.yml
+++ b/.github/workflows/ios-ship.yml
@@ -49,7 +49,7 @@ jobs:
       IOS_DIST_P12_BASE64: ${{ secrets.IOS_DIST_P12_BASE64 }}
       IOS_DIST_P12_PASSWORD: ${{ secrets.IOS_DIST_P12_PASSWORD }}
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/mac-release.yml b/.github/workflows/mac-release.yml
index 3017122..7ddc060 100644
--- a/.github/workflows/mac-release.yml
+++ b/.github/workflows/mac-release.yml
@@ -65,7 +65,7 @@ jobs:
       ASC_KEY_P8: ${{ secrets.ASC_KEY_P8 }}
       SPARKLE_ED_PRIVATE_KEY: ${{ secrets.SPARKLE_ED_PRIVATE_KEY }}
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           # CFBundleVersion is `git rev-list --count HEAD`, which needs the
           # whole history.  A shallow clone would make every build number 1.
diff --git a/.github/workflows/macos-ship.yml b/.github/workflows/macos-ship.yml
index 7917f87..11a82f7 100644
--- a/.github/workflows/macos-ship.yml
+++ b/.github/workflows/macos-ship.yml
@@ -36,7 +36,7 @@ jobs:
       MAC_INSTALLER_P12_BASE64: ${{ secrets.MAC_INSTALLER_P12_BASE64 }}
       MAC_INSTALLER_P12_PASSWORD: ${{ secrets.MAC_INSTALLER_P12_PASSWORD }}
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index c3b7848..9b0620b 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: gh-pages
           fetch-depth: 1
diff --git a/.github/workflows/swift-ci.yml b/.github/workflows/swift-ci.yml
index d33e29f..302998f 100644
--- a/.github/workflows/swift-ci.yml
+++ b/.github/workflows/swift-ci.yml
@@ -25,7 +25,7 @@ jobs:
   package:
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Swift build
         run: swift build
       - name: Swift test and render native UI fixtures
@@ -43,7 +43,7 @@ jobs:
   companion:
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Install XcodeGen and regenerate companion project
         run: |
           if ! command -v xcodegen >/dev/null 2>&1; then